07 - References

Standards and Frameworks

SLSA (Supply-chain Levels for Software Artifacts): https://slsa.dev/
CISA SBOM Guidelines: https://www.cisa.gov/sbom
OpenSSF Scorecard: Automated security checks for open-source projects. https://securityscorecards.dev/

Syft: CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. https://github.com/anchore/syft
Grype: A vulnerability scanner for container images and filesystems. https://github.com/anchore/grype
Trivy: Comprehensive security scanner. https://github.com/aquasecurity/trivy
Sigstore / Cosign: Container signing and verification. https://sigstore.dev/
OSV-Scanner: Distributed vulnerability database query tool. https://google.github.io/osv-scanner/

PyPI Trusted Publishing (OIDC): https://docs.pypi.org/trusted-publishers/
GitHub Actions Security Hardening: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions